Advanced Theme Missing .VIEW Permission

[Phil]

Hi guys,

I've just noticed now that in all versions of our advanced theme, there's nowhere use of .VIEW permissions.

I think it must be implemented in next theme release for 2 reasons:

- all other permissions are used in theme (I've myself took few minutes to realize why it wasn't working at all), then it'd appear like a bug for new admin users

- printing tags are checking for this permissions, so it's used partially, it again confuse admin who's trying to use this type of permission

I had reported in the past also about missing CATEGORY.VIEW permission by default, which is not a good point for anyone who would like to test In-Portal.

p

[Alexander Obuhovich]

This is no mistake Phil. *.VIEW permissions are used by PrintList tag internally without a need to specify them in theme directly. For example you will see empty list (instead of link list in a category), when you don't have *.VIEW permission.

• CATEGORY.VIEW permission allows to see sub-categories
• LINK.VIEW permission allows to see links inside a category and so on

p

--
You received this message because you are subscribed to the Google Groups "In-Portal Bugs Team" group.
To post to this group, send email to in-port...@googlegroups.com.
To unsubscribe from this group, send email to in-portal-bug...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/in-portal-bugs?hl=en.

--
Best Regards,

http://www.in-portal.com
http://www.alex-time.com

[Dmitry A.]

Yes, Alex is correct.

I think we should consider simplified version of Permissions for Categories (ie. none) so it's less demanding with SQL requests.

It's a separate discussion though.

DA

[Phil]

Well, I didn't said it's a mistake, but it "looks like" a bug, event if it's not one, for the reason I gave in my first post.

Do you think it's obvious not prevent user to see item list, but still be able to see item detail?

I got the problem recently, because of Google. As Google seems to use analytics tracking code to discover any website page, then any user who can browser an item detail will silently give Google the path to this item, and thus despite the fact you prevent users to see item list, it can be found from Google. More exactly, people are looking for something on Google, and they'll see a page they shouldn't have access to.

For this reason, I don't think it's a matter of simplified permissions, because it there's an option to use advanced permission in admin, then problem will remain the same. Until the guy who code the theme discover this, and make needed changes. That's why I report it here, at least.

p

Envoyé avec Sparrow

--

You received this message because you are subscribed to the Google Groups "In-Portal Bugs Team" group.

To view this discussion on the web visit https://groups.google.com/d/msg/in-portal-bugs/-/0XE4HgpRcl0J.

[Alexander Obuhovich]

I see, then we (as In-Portal developers) might consider adding following tag above category/link/product (or any category item) list:

<inp2:m_RequireLogin permissions="CATEGORY.VIEW|LINK.VIEW" login_template="platform/login/register"/>

This way instead of showing empty category/link/product (other category item) list when user don't have permission then we will redirect to no_permission page or, if user not logged-in, then to login/register template.

Actually we don't show sub-categories which don't have CATEGORY.VIEW permission inside them.


Adding same tag on item (link/product/etc.) detail template (on top) would solve this problem.

[Phil]

I was thinking about adding a separate permission check, because it may be different from logged users permissions, and we can set these permissions already from admin.

Envoyé avec Sparrow

[Dmitry A.]

Phil,

I wouldn't go with having 2 permission types. It's better stick to 1 idea and improve it if there are issues with it.

DA

[Alexander Obuhovich]

That's what Phil was suggesting. Not new permission, but a separate check (e.g. via tag + internal as we already do) for existing .VIEW permission to make theme more Google-compliant.

DA

--

You received this message because you are subscribed to the Google Groups "In-Portal Bugs Team" group.

To view this discussion on the web visit https://groups.google.com/d/msg/in-portal-bugs/-/WRfhhPEWSUQJ.

To post to this group, send email to in-port...@googlegroups.com.
To unsubscribe from this group, send email to in-portal-bug...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/in-portal-bugs?hl=en.

[Phil -- wbtc.fr --]

Dmitry, I suggest to insert .VIEW permissions for each type of item, in advanced theme, for each item detail page. Nothing more :-)

2012/5/26 Alexander Obuhovich <aik....@gmail.com>

[Dmitry A.]

Thanks for clarification.

Please create a task for this.

DA

[Alexander Obuhovich]

Here is the task: http://tracker.in-portal.org/view.php?id=1312

DA

--

You received this message because you are subscribed to the Google Groups "In-Portal Bugs Team" group.

To view this discussion on the web visit https://groups.google.com/d/msg/in-portal-bugs/-/soEs_3sO4Q8J.

To post to this group, send email to in-port...@googlegroups.com.
To unsubscribe from this group, send email to in-portal-bug...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/in-portal-bugs?hl=en.

[Alexander Obuhovich]

Here is the patch, ready for testing.